Method to detect and counteract suspicious activity in an application environment

A non-transitory, machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising:

• receiving a selection of an application included in a plurality of applications;
• presenting a simulation of an execution of the application to generate a model that is representative of a plurality of users and a plurality of input devices;
• obtaining a first identification of a first user of the plurality of users and a second identification of a first input device of the plurality of input devices associated with an execution of the application;
• executing the application subsequent to the obtaining the first identification and the second identification;
• receiving at least one input from the first input device during the executing of the application;
• responsive to the receiving of the at least one input, obtaining a validation request based on a comparison of the at least one input and the model;
• responsive to the receiving of the at least one input, polling at least one additional user;
• and
• determining a probability that the first user is engaging in an unauthorized activity based on the polling.

A method, comprising:

• receiving, by a processing system including a processor, a selection of an application included in a plurality of applications;
• presenting, by the processing system, a simulation of an execution of the application to generate a model that is representative of a plurality of users and a plurality of input devices;
• obtaining, by the processing system, a first identification of a first user of the plurality of users and a second identification of a first input device of the plurality of input devices associated with an execution of the application;
• executing, by the processing system, the application subsequent to the obtaining the first identification and the second identification;
• receiving, by the processing system, at least one input from the first input device during the executing of the application;
• responsive to the receiving of the at least one input, obtaining, by the processing system, a validation request based on a comparison of the at least one input and the model;
• responsive to the receiving of the at least one input, polling, by the processing system, at least one additional user;
• and
• determining, by the processing system, a probability that the first user is engaging in an unauthorized activity based on the polling.